PT-2005-3843 · Opera · Opera

Jakob Balle · Publicado 2005-09-21 · Atualizado 2017-07-11 · CVE-2005-3006

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Opera versions prior to 8.50

Description The issue allows remote attackers to inject arbitrary web script and potentially spoof attachment filenames by opening attached files from the user's cache directory without warning. This might occur when arbitrary JavaScript is executed in the context of "file://", potentially leading to a loss of confidentiality if a user chooses to view an attachment.

Recommendations For Opera versions prior to 8.50, update to version 8.50 or later to resolve the issue. As a temporary workaround, consider avoiding the execution of arbitrary JavaScript in the context of "file://" and be cautious when viewing attachments to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-3006

Produtos afetados

Opera

Referências · 12

• https://nvd.nist.gov/vuln/detail/CVE-2005-3006 · Nota de Segurança
• http://secunia.com/secunia_research/2005-42/advisory · Aviso do Fabricante
• http://securityfocus.com/advisories/9339 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=112724692219695&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22335 · Nota
• http://secunia.com/advisories/16645 · Aviso do Fabricante
• http://opera.com/docs/changelogs/windows/850 · Nota
• http://securityfocus.com/bid/14880 · Nota
• http://opera.com/docs/changelogs/linux/850 · Nota
• http://vupen.com/english/advisories/2005/1789 · Nota
• http://xforce.iss.net/xforce/xfdb/22335 · Nota
• http://osvdb.org/19508 · Correção